Retire the OVN cleanup scripts into kubectl us-net

Start with scripts/cleanup_dead_ovn_ha_chassis.py, scripts/cleanup_orphaned_ovn_uplinks.py, and the router audit/repair entry points; read the liveness logic in python/neutron-understack/neutron_understack/routers.py and review #2342. Done requires an agreed fleet-wide workflow, decisions on orphan teardown, equivalent coverage for the listed gaps, and retirement of the scripts.

kubectl us-net router audit / router repair (added for #2330) now overlap several one-off scripts under scripts/. The intent is for the command to become the single entry point and for the scripts to be retired.

Overlap today

scripts/cleanup_dead_ovn_ha_chassis.py

• Phase 1 — stale HA_Chassis removal: partially covered. router repair only removes stale members from per-network groups that have no live members, and only for the single router named on the command line. The script sweeps every HA_Chassis row in the NB DB.
• Phase 2 — empty per-network HCG repopulation: covered, under the same contract (liveness from the SB Chassis registry, options:chassis as the primary source, fallback to neutron-<router_id> only when it resolves to exactly one live chassis, priority 32767).
• Phase 3 — opt-in orphan-network teardown (--delete-orphaned-networks): no equivalent.

scripts/cleanup_orphaned_ovn_uplinks.py

• Detects uplink-* LSPs with no matching Neutron port: no equivalent. The command's uplink audit runs Neutron-to-OVN only.

Blockers

• The coverage gaps in #2342 — specifically stale members in otherwise-live groups, and orphaned uplink-* LSPs.
• No fleet-wide mode. audit and repair are deliberately single-router (an early --all flag was removed). Retirement needs either a fleet-wide entry point or an accepted "loop over routers" workflow.
• A decision on phase 3. Its teardown is destructive and confirms with Neutron that a network is genuinely gone before deleting anything. Worth deciding whether that belongs in the same tool as the narrow, safe field-level repair, or stays separate.

Note

Phase 1's original rationale has partly expired. Its docstring says a single stale HA_Chassis row anywhere blocks link_vxlan_network_ha_chassis_group's fleet-wide "exactly one distinct live chassis" inference, but that function now filters non-live rows before inferring (python/neutron-understack/neutron_understack/routers.py). What remains is hygiene, and not tripping neutron_ovn_db_sync_util.

Related

• #2330 — the OVN NB drift that motivated the commands
• #2342 — coverage gaps that block this
• #2245 — router uplink dynamic VLAN segment leaked on interface removal; overlaps the uplink cleanup story